Vincent550102

**Name of the Vulnerable Software and Affected Versions** Winter CMS versions prior to 1.2.13 **Description** Theme Editor AJAX handlers in the CMS section do not enforce per-template-type permission checks. While the CMS controller `CmsControllersIndex` uses OR-logic across five permissions (`cms.manage pages`, `cms.manage partials`, `cms.manage layouts`, `cms.manage content`, `cms.manage assets`) to grant access to the section, individual handlers such as `onSave()`, `onDelete()`, and `onDeleteTemplates()` fail to verify if the user possesses the specific permission for the requested template type. This allows an authenticated backend user with any single CMS permission to perform unauthorized actions, such as deleting layouts, modifying partials, or reading content files. Additionally, the `AssetList` widget is registered for any user passing the controller gate regardless of the `cms.manage assets` permission, and its `onUpload()` handler lacks the theme-validation call used by other mutating handlers, enabling unauthorized file uploads into the active theme's asset directory. **Recommendations** Update to version 1.2.13. As a temporary workaround, in `modules/cms/controllers/Index.php`, wrap each widget registration in the constructor with the corresponding `hasAccess()` check and add a `validateRequestType()` call to the `index onOpenTemplate()`, `onSave()`, `onCreateTemplate()`, `onDeleteTemplates()`, `onDelete()`, `onCommit()`, and `onReset()` handlers to verify the user holds the permission for the requested template type. As a temporary workaround, in `modules/cms/widgets/AssetList.php`, add a `$this->validateRequestTheme()` call at the top of the `onUpload()` method.

**Name of the Vulnerable Software and Affected Versions** Caddy versions prior to 2.11.4 **Description** On Windows, a mismatch exists between how Caddy path matchers and the `file server` handle request paths. The `MatchPath.MatchWithError()` function compares the `r.URL.Path` using URL path semantics and does not normalize backslashes (``) to forward slashes (`/`). Consequently, a request path such as `/privatesecret.txt` is treated as being outside the `/private/*` scope. However, the `file server` later resolves this same path using `SanitizedPathJoin()`, and since Windows treats backslashes as directory separators, the file within the protected directory is served. This allows an unauthenticated remote client to bypass path-scoped authorization or deny routes, leading to the disclosure of sensitive files within the protected subtree. **Recommendations** Update to version 2.11.4. As a temporary workaround, restrict access to the `file server` module or avoid using path-scoped auth/deny routes to protect sensitive directories on Windows until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Caddy versions prior to 2.11.4 **Description** An issue exists where `forward auth copy headers` deletes client-supplied identity headers before copying trusted values from an authentication gateway. However, when requests are processed via `php fastcgi`, Caddy normalizes HTTP headers into CGI variables by replacing hyphens (`-`) with underscores (` `). This allows a remote client to send an underscore alias (e.g., `Remote Groups` instead of `Remote-Groups`) that bypasses the deletion step but results in the same PHP/FastCGI variable (e.g., `HTTP REMOTE GROUPS`). Consequently, a remote client can inject or override identity or group headers trusted by PHP/FastCGI applications behind Caddy, potentially leading to group/role injection or user impersonation. **Recommendations** Update to version 2.11.4. As a temporary workaround, restrict the use of the `php fastcgi` module or the `forward auth` `copy headers` feature for identity headers until the update is applied.